@safetnsr/vet 1.6.1 → 1.7.0

package/dist/categories.d.ts

@@ -1,5 +1,7 @@
 import type { CheckResult, CategoryResult, VetResult } from './types.js';
 export declare function toGrade(score: number): string;
+/** Apply a floor of 20 to non-security checks that have no security-related errors */
+export declare function applyScoreFloor(check: CheckResult): number;
 export declare function buildCategories(checkMap: {
     security: CheckResult[];
     integrity: CheckResult[];

package/dist/categories.js

@@ -21,11 +21,20 @@ const WEIGHTS = {
     debt: 0.25,
     deps: 0.15,
 };
+// ── Scoring floor for non-security checks ────────────────────────────────────
+const SECURITY_CHECKS = new Set(['scan', 'secrets', 'permissions', 'owasp']);
+/** Apply a floor of 20 to non-security checks that have no security-related errors */
+export function applyScoreFloor(check) {
+    if (SECURITY_CHECKS.has(check.name))
+        return check.score;
+    // Non-security check: minimum score is 20
+    return Math.max(20, check.score);
+}
 // ── Average scores within a category ────────────────────────────────────────
 function averageScore(checks) {
     if (checks.length === 0)
         return 100;
-    const total = checks.reduce((sum, c) => sum + c.score, 0);
+    const total = checks.reduce((sum, c) => sum + applyScoreFloor(c), 0);
     return Math.round(total / checks.length);
 }
 // ── Group checks into categories ─────────────────────────────────────────────

package/dist/checks/models.js

@@ -1,5 +1,50 @@
-import { join } from 'node:path';
+import { join, basename } from 'node:path';
 import { readFile, walkFiles } from '../util.js';
+// ── AI framework detection ───────────────────────────────────────────────────
+const AI_NAME_KEYWORDS = ['ai', 'llm', 'model', 'openai', 'anthropic', 'langchain', 'provider'];
+const AI_PKG_KEYWORDS = new Set(['ai', 'llm', 'language-model', 'openai', 'anthropic']);
+function isAiFramework(cwd) {
+    // Check package.json
+    const pkgRaw = readFile(join(cwd, 'package.json'));
+    if (pkgRaw) {
+        try {
+            const pkg = JSON.parse(pkgRaw);
+            const name = (pkg.name || '').toLowerCase();
+            if (AI_NAME_KEYWORDS.some(k => name.includes(k)))
+                return true;
+            if (Array.isArray(pkg.keywords) && pkg.keywords.some((k) => AI_PKG_KEYWORDS.has(k.toLowerCase())))
+                return true;
+        }
+        catch { /* skip */ }
+    }
+    // Check pyproject.toml / setup.py for AI deps
+    const pyproject = readFile(join(cwd, 'pyproject.toml'));
+    if (pyproject) {
+        const aiDeps = ['openai', 'anthropic', 'langchain', 'transformers', 'torch', 'tensorflow'];
+        if (aiDeps.some(d => pyproject.includes(d)))
+            return true;
+    }
+    const setupPy = readFile(join(cwd, 'setup.py'));
+    if (setupPy) {
+        const aiDeps = ['openai', 'anthropic', 'langchain', 'transformers', 'torch', 'tensorflow'];
+        if (aiDeps.some(d => setupPy.includes(d)))
+            return true;
+    }
+    return false;
+}
+// ── Test/example/docs path detection ─────────────────────────────────────────
+const TEST_DOCS_PATTERNS = ['test/', 'tests/', '__tests__/', 'examples/', 'docs/'];
+function isTestOrDocsFile(filePath) {
+    const normalized = filePath.replace(/\\/g, '/');
+    if (TEST_DOCS_PATTERNS.some(p => normalized.includes(p) || normalized.startsWith(p)))
+        return true;
+    const base = basename(filePath);
+    if (/\.(test|spec)\./i.test(base))
+        return true;
+    if (base.endsWith('.md'))
+        return true;
+    return false;
+}
 // Try to use @safetnsr/model-graveyard if installed (248 models, alias matching, YAML registry)
 async function tryModelGraveyard(cwd) {
     try {
@@ -8,6 +53,7 @@ async function tryModelGraveyard(cwd) {
             return null;
         const report = await mod.scan(cwd);
         const issues = [];
+        const aiFramework = isAiFramework(cwd);
         // Files that define deprecated model registries should not be flagged
         const SELF_FILES = ['models.ts', 'models.js', 'model-graveyard', 'model-registry', 'sunset', 'fix/models'];
         for (const match of report.matches) {
@@ -17,8 +63,10 @@ async function tryModelGraveyard(cwd) {
             if (match.file && SELF_FILES.some(s => match.file.toLowerCase().includes(s)))
                 continue;
             if (match.model.status === 'deprecated' || match.model.status === 'eol') {
+                const inTestDocs = match.file && isTestOrDocsFile(match.file);
+                const severity = (aiFramework || inTestDocs) ? 'info' : 'error';
                 issues.push({
-                    severity: 'error',
+                    severity,
                     message: `${match.model.status} model "${match.raw}" in ${match.file}:${match.line}${match.model.successor ? ` — use "${match.model.successor}"` : ''}`,
                     file: match.file,
                     line: match.line,
@@ -27,15 +75,22 @@ async function tryModelGraveyard(cwd) {
                 });
             }
         }
-        const score = Math.max(0, 100 - issues.length * 20);
+        const errorCount = issues.filter(i => i.severity === 'error').length;
+        const score = aiFramework
+            ? Math.max(70, 100 - errorCount * 20)
+            : Math.max(0, 100 - errorCount * 20);
+        let summary = issues.length === 0
+            ? `${report.filesScanned} files scanned (via model-graveyard) — all current`
+            : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} (via model-graveyard)`;
+        if (aiFramework) {
+            summary += ' — AI framework detected — model references are expected';
+        }
         return {
             name: 'models',
             score: Math.min(100, score),
             maxScore: 100,
             issues,
-            summary: issues.length === 0
-                ? `${report.filesScanned} files scanned (via model-graveyard) — all current`
-                : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} (via model-graveyard)`,
+            summary,
         };
     }
     catch {
@@ -87,6 +142,7 @@ function builtinModels(cwd, ignore) {
     const issues = [];
     const files = walkFiles(cwd, ignore);
     const found = new Map();
+    const aiFramework = isAiFramework(cwd);
     for (const f of files) {
         if (!SCAN_EXTS.some(ext => f.endsWith(ext)))
             continue;
@@ -105,24 +161,42 @@ function builtinModels(cwd, ignore) {
             found.set(model, existing);
         }
     }
-    for (const [model, files] of found) {
+    for (const [model, modelFiles] of found) {
         const info = SUNSET_MODELS[model];
-        const fileList = files.length <= 2 ? files.join(', ') : `${files[0]} +${files.length - 1} more`;
+        const fileList = modelFiles.length <= 2 ? modelFiles.join(', ') : `${modelFiles[0]} +${modelFiles.length - 1} more`;
+        // Determine severity: downgrade for AI frameworks or test/docs files
+        const allInTestDocs = modelFiles.every(f => isTestOrDocsFile(f));
+        const severity = (aiFramework || allInTestDocs) ? 'info' : 'error';
         issues.push({
-            severity: 'error',
+            severity,
             message: `deprecated model "${model}" in ${fileList} — use "${info.replacement}"${info.sunset ? ` (sunset ${info.sunset})` : ''}`,
-            file: files[0],
+            file: modelFiles[0],
             fixable: true,
             fixHint: `replace "${model}" with "${info.replacement}"`,
         });
     }
-    const score = Math.max(0, 100 - issues.length * 20);
+    let score;
+    if (aiFramework) {
+        // AI framework: models exist for compatibility, score 70+ base
+        const errorCount = issues.filter(i => i.severity === 'error').length;
+        score = Math.max(70, 100 - errorCount * 20);
+    }
+    else {
+        const errorCount = issues.filter(i => i.severity === 'error').length;
+        score = Math.max(0, 100 - errorCount * 20);
+    }
+    let summary = issues.length === 0
+        ? 'all model references current'
+        : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} found`;
+    if (aiFramework) {
+        summary += ' — AI framework detected — model references are expected';
+    }
     return {
         name: 'models',
         score: Math.min(100, score),
         maxScore: 100,
         issues,
-        summary: issues.length === 0 ? 'all model references current' : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} found`,
+        summary,
     };
 }
 export async function checkModels(cwd, ignore) {

package/dist/checks/scan.js

@@ -85,9 +85,10 @@ const CONFIG_TARGETS = [
     '.claude', 'CLAUDE.md', 'AGENTS.md',
     '.cursorrules', '.cursor',
     '.github',
-    '.aider.conf.yml',
+    'copilot-instructions.md',
+    '.aider.conf.yml', '.aider',
     '.continue',
-    '.mcp',
+    '.mcp', 'mcp.json', '.mcp.json',
     '.roomodes', '.roo',
 ];
 // ── File helpers (delegated to util.ts) ──────────────────────────────────────

package/dist/checks/verify.js

@@ -1,4 +1,4 @@
-import { join, basename } from 'node:path';
+import { join, basename, extname } from 'node:path';
 import { readFileSync, existsSync, statSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 // ── Helpers ──────────────────────────────────────────────────────────────────
@@ -10,9 +10,48 @@ function safeExec(cmd, cwd) {
         return '';
     }
 }
+// ── Config/meta file exclusion for thin-file checks ──────────────────────────
+const CONFIG_DOTFILES = new Set([
+    '.gitignore', '.gitattributes', '.nvmrc', '.node-version', '.editorconfig',
+    '.prettierrc', '.eslintignore', '.npmrc', '.npmignore',
+]);
+const CONFIG_EXTENSIONS = new Set([
+    '.yml', '.yaml', '.json', '.toml', '.cfg', '.ini', '.lock', '.svg', '.xml',
+]);
+const CONFIG_DIRS = ['.github/', '.husky/', '.vscode/', '.idea/'];
+const META_FILES = new Set([
+    'FUNDING.yaml', 'CODEOWNERS', 'LICENSE',
+]);
+function isConfigOrMetaFile(filePath) {
+    const base = basename(filePath);
+    const ext = extname(filePath).toLowerCase();
+    const normalized = filePath.replace(/\\/g, '/');
+    // Dotfiles
+    if (CONFIG_DOTFILES.has(base))
+        return true;
+    // Config extensions
+    if (CONFIG_EXTENSIONS.has(ext))
+        return true;
+    // Config directories
+    if (CONFIG_DIRS.some(d => normalized.includes(d) || normalized.startsWith(d)))
+        return true;
+    // Meta files
+    if (META_FILES.has(base))
+        return true;
+    if (base.startsWith('CHANGELOG'))
+        return true;
+    return false;
+}
+// ── Code file extensions for test detection ──────────────────────────────────
+const CODE_EXTENSIONS = new Set(['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs']);
+const TEST_FILE_PATTERN = /\.(test|spec)\.(ts|js|tsx|jsx)$/i;
 function isTestFile(filePath) {
     const base = basename(filePath);
-    if (/\.(test|spec)\.[a-z]+$/i.test(base))
+    const ext = extname(filePath).toLowerCase();
+    // Only code files can be test files
+    if (!CODE_EXTENSIONS.has(ext))
+        return false;
+    if (TEST_FILE_PATTERN.test(base))
         return true;
     const normalized = filePath.replace(/\\/g, '/');
     // Match __tests__/ anywhere in path (including at root)
@@ -186,6 +225,11 @@ export function checkVerify(cwd, since) {
             verified++;
             continue;
         }
+        // Skip thin file check for config/meta files (they're supposed to be small)
+        if (isConfigOrMetaFile(relPath)) {
+            verified++;
+            continue;
+        }
         if (lineCount < 10 && lineCount > 0) {
             issues.push({
                 severity: 'warning',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.6.1",
+  "version": "1.7.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {